Windows NtUserGetClipboardAccessToken Token Leak Redux
Posted by deepcore on September 20, 2015 – 6:06 am
The NtUserGetClipboardAccessToken win32k system call exposes the access token of the last user to lower-privileged users. It can also be used to open an anonymous impersonation thread token which normally OpenThreadToken shouldn’t be able to do. This is a bypass of the fix for CVE-2015-0078.
Post a reply
You must be logged in to post a comment.